.env.schema

# Baudbot agent configuration schema
# See CONFIGURATION.md for details on each variable.
#
# Secrets live at ~/.config/.env (600 perms, never committed).
# This schema is deployed to ~/.config/.env.schema alongside the .env file.
#
# @defaultSensitive=true
# @defaultRequired=false
# ---

# ── LLM Access ───────────────────────────────────────────────────────────────
# Set at least one. Multiple can coexist — switch models at runtime.

# Anthropic API key (Claude models)
# @type=string(startsWith=sk-ant-)
# @docs(https://console.anthropic.com/settings/keys)
ANTHROPIC_API_KEY=

# OpenAI API key (GPT, o-series models)
# @type=string(startsWith=sk-)
# @docs(https://platform.openai.com/api-keys)
OPENAI_API_KEY=

# Google Gemini API key
# @type=string
# @docs(https://aistudio.google.com/apikey)
GEMINI_API_KEY=

# OpenCode Zen API key (multi-provider router)
# @type=string
# @docs(https://opencode.ai)
OPENCODE_ZEN_API_KEY=

# Override auto-detected model (e.g. anthropic/claude-haiku for CI)
# @sensitive=false @type=string
BAUDBOT_MODEL=

# ── Slack / Gateway bridge ───────────────────────────────────────────────────

# Preferred naming: GATEWAY_*
# Legacy naming: SLACK_* (still supported)
# If both are set, GATEWAY_* takes precedence.

# Gateway bot OAuth token (preferred; required for direct Socket Mode, optional in broker mode)
# @type=string(startsWith=xoxb-)
# @docs("Create a Slack app", https://api.slack.com/apps)
GATEWAY_BOT_TOKEN=

# Legacy alias for GATEWAY_BOT_TOKEN
# @type=string(startsWith=xoxb-)
SLACK_BOT_TOKEN=

# Gateway app-level token (preferred; Socket Mode; optional in broker mode)
# @type=string(startsWith=xapp-)
GATEWAY_APP_TOKEN=

# Legacy alias for GATEWAY_APP_TOKEN
# @type=string(startsWith=xapp-)
SLACK_APP_TOKEN=

# Comma-separated Slack user IDs allowed to interact with the agent (preferred)
# Optional — if unset, all workspace members can interact.
# @sensitive=false @type=string
# @example="U01ABCDEF,U02GHIJKL"
GATEWAY_ALLOWED_USERS=

# Legacy alias for GATEWAY_ALLOWED_USERS
# @sensitive=false @type=string
# @example="U01ABCDEF,U02GHIJKL"
SLACK_ALLOWED_USERS=

# ── Experimental Feature Flag ───────────────────────────────────────────────

# Enable experimental integrations (currently required for email tooling)
# @sensitive=false @type=number
BAUDBOT_EXPERIMENTAL=0

# ── Email Monitor (experimental-only) ───────────────────────────────────────

# AgentMail API key (only used when BAUDBOT_EXPERIMENTAL=1)
# @type=string
# @docs(https://app.agentmail.to)
AGENTMAIL_API_KEY=

# Agent's monitored email address (only used when BAUDBOT_EXPERIMENTAL=1)
# @sensitive=false @type=email
BAUDBOT_EMAIL=

# Shared secret for email sender authentication (only used when BAUDBOT_EXPERIMENTAL=1)
# @type=string
BAUDBOT_SECRET=

# Comma-separated sender email allowlist (only used when BAUDBOT_EXPERIMENTAL=1)
# @sensitive=false @type=string
# @example="you@example.com,teammate@example.com"
BAUDBOT_ALLOWED_EMAILS=

# ── Sentry (optional) ───────────────────────────────────────────────────────

# Sentry API bearer token
# @type=string
# @docs(https://sentry.io/settings/account/api/auth-tokens/)
SENTRY_AUTH_TOKEN=

# Sentry organization slug
# @sensitive=false @type=string
SENTRY_ORG=

# Slack channel ID for Sentry alerts
# @sensitive=false @type=string(startsWith=C)
SENTRY_CHANNEL_ID=

# ── Gateway / Slack Channels (optional) ─────────────────────────────────────

# Additional monitored channel (preferred; responds to all messages, not just @mentions)
# @sensitive=false @type=string(startsWith=C)
GATEWAY_CHANNEL_ID=

# Legacy alias for GATEWAY_CHANNEL_ID
# @sensitive=false @type=string(startsWith=C)
SLACK_CHANNEL_ID=

# ── Kernel (optional) ───────────────────────────────────────────────────────

# Kernel cloud browser API key
# @type=string
# @docs(https://kernel.computer)
KERNEL_API_KEY=

# ── Gateway/Slack Broker Registration (optional) ────────────────────────────

# Gateway broker base URL (preferred)
# @sensitive=false @type=url
GATEWAY_BROKER_URL=

# Legacy alias for GATEWAY_BROKER_URL
# @sensitive=false @type=url
SLACK_BROKER_URL=

# Gateway org ID registered with broker (preferred)
# @sensitive=false @type=string
GATEWAY_BROKER_ORG_ID=

# Legacy alias for GATEWAY_BROKER_ORG_ID
# @sensitive=false @type=string
SLACK_BROKER_ORG_ID=

# Deprecated workspace/team ID aliases (still accepted for migration).
# May contain either legacy Slack workspace IDs (T...) or broker org IDs (org_...).
# @sensitive=false @type=string
GATEWAY_BROKER_WORKSPACE_ID=

# @sensitive=false @type=string
SLACK_BROKER_WORKSPACE_ID=

# Gateway server X25519 private key (base64, preferred)
# @type=string
GATEWAY_BROKER_SERVER_PRIVATE_KEY=

# Legacy alias for GATEWAY_BROKER_SERVER_PRIVATE_KEY
# @type=string
SLACK_BROKER_SERVER_PRIVATE_KEY=

# Gateway server X25519 public key (base64, preferred)
# @sensitive=false @type=string
GATEWAY_BROKER_SERVER_PUBLIC_KEY=

# Legacy alias for GATEWAY_BROKER_SERVER_PUBLIC_KEY
# @sensitive=false @type=string
SLACK_BROKER_SERVER_PUBLIC_KEY=

# Gateway server Ed25519 private signing key (base64, preferred)
# @type=string
GATEWAY_BROKER_SERVER_SIGNING_PRIVATE_KEY=

# Legacy alias for GATEWAY_BROKER_SERVER_SIGNING_PRIVATE_KEY
# @type=string
SLACK_BROKER_SERVER_SIGNING_PRIVATE_KEY=

# Gateway server Ed25519 public signing key (base64, preferred)
# @sensitive=false @type=string
GATEWAY_BROKER_SERVER_SIGNING_PUBLIC_KEY=

# Legacy alias for GATEWAY_BROKER_SERVER_SIGNING_PUBLIC_KEY
# @sensitive=false @type=string
SLACK_BROKER_SERVER_SIGNING_PUBLIC_KEY=

# Gateway broker X25519 public key (base64, preferred)
# @sensitive=false @type=string
GATEWAY_BROKER_PUBLIC_KEY=

# Legacy alias for GATEWAY_BROKER_PUBLIC_KEY
# @sensitive=false @type=string
SLACK_BROKER_PUBLIC_KEY=

# Gateway broker Ed25519 public signing key (base64, preferred)
# @sensitive=false @type=string
GATEWAY_BROKER_SIGNING_PUBLIC_KEY=

# Legacy alias for GATEWAY_BROKER_SIGNING_PUBLIC_KEY
# @sensitive=false @type=string
SLACK_BROKER_SIGNING_PUBLIC_KEY=

# Gateway broker-issued bearer token for broker API auth (preferred; required for broker pull mode)
# @type=string
GATEWAY_BROKER_ACCESS_TOKEN=

# Legacy alias for GATEWAY_BROKER_ACCESS_TOKEN
# @type=string
SLACK_BROKER_ACCESS_TOKEN=

# Optional gateway broker token expiration timestamp (ISO-8601, preferred)
# @sensitive=false @type=string
GATEWAY_BROKER_ACCESS_TOKEN_EXPIRES_AT=

# Legacy alias for GATEWAY_BROKER_ACCESS_TOKEN_EXPIRES_AT
# @sensitive=false @type=string
SLACK_BROKER_ACCESS_TOKEN_EXPIRES_AT=

# Optional gateway broker token scopes (comma-separated, preferred)
# @sensitive=false @type=string
GATEWAY_BROKER_ACCESS_TOKEN_SCOPES=

# Legacy alias for GATEWAY_BROKER_ACCESS_TOKEN_SCOPES
# @sensitive=false @type=string
SLACK_BROKER_ACCESS_TOKEN_SCOPES=

# Optional comma-separated GitHub logins ignored by broker GitHub event forwarding.
# "baudbot-agent" is always ignored to prevent bot loops.
# @sensitive=false @type=string
# @example="dependabot[bot],renovate[bot]"
GITHUB_IGNORED_USERS=

# Optional agent version override used in broker observability metadata.
# If unset, broker bridge falls back to ~/.pi/agent/baudbot-version.json (if present).
# @sensitive=false @type=string
BAUDBOT_AGENT_VERSION=

# Gateway broker pull cadence in milliseconds (preferred; default: 3000)
# @sensitive=false @type=number
GATEWAY_BROKER_POLL_INTERVAL_MS=3000

# Legacy alias for GATEWAY_BROKER_POLL_INTERVAL_MS
# @sensitive=false @type=number
SLACK_BROKER_POLL_INTERVAL_MS=3000

# Gateway max messages to lease per inbox pull request (preferred; default: 10)
# @sensitive=false @type=number
GATEWAY_BROKER_MAX_MESSAGES=10

# Legacy alias for GATEWAY_BROKER_MAX_MESSAGES
# @sensitive=false @type=number
SLACK_BROKER_MAX_MESSAGES=10

# Gateway long-poll wait window in seconds (preferred; default: 20, max: 25)
# @sensitive=false @type=number
GATEWAY_BROKER_WAIT_SECONDS=20

# Legacy alias for GATEWAY_BROKER_WAIT_SECONDS
# @sensitive=false @type=number
SLACK_BROKER_WAIT_SECONDS=20

# Gateway dedupe cache TTL in milliseconds (preferred; default: 20 minutes)
# @sensitive=false @type=number
GATEWAY_BROKER_DEDUPE_TTL_MS=1200000

# Legacy alias for GATEWAY_BROKER_DEDUPE_TTL_MS
# @sensitive=false @type=number
SLACK_BROKER_DEDUPE_TTL_MS=1200000

# ── Linear (optional) ────────────────────────────────────────────────────────

# Linear API key (personal or OAuth token)
# @type=string
# @docs(https://linear.app/settings/api)
LINEAR_API_KEY=

# ── Notion (optional) ────────────────────────────────────────────────────────

# Notion integration secret (internal integration token)
# @type=string
# @docs(https://www.notion.so/my-integrations)
NOTION_API_KEY=

# ── Tool Guard ───────────────────────────────────────────────────────────────

# Unix username of the agent
# @sensitive=false @type=string
BAUDBOT_AGENT_USER=baudbot_agent

# Agent's home directory
# @sensitive=false @type=string
BAUDBOT_AGENT_HOME=/home/baudbot_agent

# Path to admin-owned source repo (enables source repo write protection)
# @sensitive=false @type=string
BAUDBOT_SOURCE_DIR=

# ── Startup Integrity ────────────────────────────────────────────────────────

# Startup deploy-manifest integrity mode: off | warn | strict
# @sensitive=false @type=string
BAUDBOT_STARTUP_INTEGRITY_MODE=warn

# ── Bridge ───────────────────────────────────────────────────────────────────

# Local HTTP API port for outbound Slack messages
# @sensitive=false @type=port
BRIDGE_API_PORT=7890

# Target pi session ID (auto-detects control-agent if unset)
# @sensitive=false @type=string
PI_SESSION_ID=

# Bridge restart policy mode: legacy (fixed 5s restart) or adaptive (backoff + jitter)
# @sensitive=false @type=string
BAUDBOT_BRIDGE_RESTART_POLICY=

# Adaptive restart base delay (seconds)
# @sensitive=false @type=number
BAUDBOT_BRIDGE_RESTART_BASE_DELAY_SECONDS=

# Adaptive restart max delay cap (seconds)
# @sensitive=false @type=number
BAUDBOT_BRIDGE_RESTART_MAX_DELAY_SECONDS=

# Adaptive restart stable runtime window before counters reset (seconds)
# @sensitive=false @type=number
BAUDBOT_BRIDGE_RESTART_STABLE_WINDOW_SECONDS=

# Adaptive restart degraded-state threshold for consecutive failures
# @sensitive=false @type=number
BAUDBOT_BRIDGE_RESTART_MAX_CONSECUTIVE_FAILURES=

# Adaptive restart random jitter upper bound (seconds)
# @sensitive=false @type=number
BAUDBOT_BRIDGE_RESTART_JITTER_SECONDS=